CVE-2023-32691 ginuerzh/gost vulnerable to Timing Attack
Attackers can guess secrets via timing attacks due to non-constant-time comparison of HTTP headers in gost.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-32691?
CVE-2023-32691 is a medium-severity vulnerability in ginuerzh gost, published on 30 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
gost (GO Simple Tunnel) is a simple tunnel written in golang. Sensitive secrets such as passwords, token and API keys should be compared only using a constant-time comparison function. Untrusted input, sourced from a HTTP header, is compared directly with a secret. Since this comparison is not secure, an attacker can mount a side-channel timing attack to guess the password. As a workaround, this can be easily fixed using a constant time comparing function such as `crypto/subtle`'s `ConstantTimeCompare`.
Weakness: CWE-203
Which versions are affected by CVE-2023-32691?
2 open source packages ship an affected version, including github.com/ginuerzh/gost. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/ginuerzh/gost Go | All versions to 2.11.5 | None |
github.com/ginuerzh/gost Go | All versions to 2.11.5 | None |
Products include Go Simple Tunnel Project Go Simple Tunnel.
How do I fix CVE-2023-32691?
No fix has been published for CVE-2023-32691 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-32691 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-32691 exists.
Sources
Also known as GHSA-qjrq-hm79-49ww.